September 2, 2015
Dear Sirs,
We would like to update you on the latest news regarding the Federal Law № 242-FZ introducing amendments to the Federal Law “On personal data” and to the Federal Law “On information, information technologies and protection of information” (hereinafter – “Personal Data Localization Law”) which has come into force from September 1, 2015.
The Russian Ministry of Communications has recently issued several important clarifications in respect of scope of application of the Personal Data Localization Law.
Please find below their summary.
1. Air tickets are out of scope of the Personal Data Localization Law
In accordance with clarifications of Ministry of Communications foreign air ticket booking systems are not required to comply with the new provisions of the Law if they process and store personal data only for the purposes of sales, booking or exchange of tickets. It is opinion of the Ministry of Communications that the Personal Data Localization Law should not apply to the air ticket booking systems, as the processing of personal data in this case is subject to the laws on transport security and various international treaties such as the Chicago Convention, the Warsaw Convention and the Guadalajara Convention which regulate activities of airlines companies and related information processes.
The Law does not apply to the companies agents of the airlines companies as well, provided that they process and store personal data for the same the purposes as mentioned above.
2. Further clarifications of the Ministry of Communications on the the Personal Data Localization Law
Earlier this month the Ministry of Communications has also published on its website general clarifications on the Personal Data Localization Law in the format of Q & A. We have summarized them in the table below.
QUESTION RAISED
POSITION OF THE MINISTRY
Applicability of the Personal Data Localization Law to the foreign entities having no legal presence in Russia
Under general rule, Russian legislation including Personal Data Localization Law is applicable only within the territory of Russia. However, taking into account the role of Internet and e-commerce the specific criteria of applicability of the laws shall be used.
In this context, the Ministry suggested that target-based test shall be applied to the entities functioning in the sphere of e-commerce in order to decide whether their activity is covered by the Personal Data Localization Law.
Application of target test (criteria to be used)
Target test implies examining whether a web site targets Russian consumers in its business operations. Ministry suggested that the following circumstances / criteria may be examined under the target test:
· Whether domain name of the website relates to Russia and any Russian region (e.g., .ru, .рф, .su, .москва, moscow, etc.), and (or)
· Whether a website has Russian version or there are any options to arrange translation (automatically) of its content into the Russian.
Ministry acknowledged that Russian language was widely spread in some foreign countries. With regard to these situations it suggested to apply additional criteria, namely:
· Website allows making payments in rubles;
· Website’s content implies that the performance of a contract can be arranged in the territory of Russia (e.g., delivery of goods to Russia);
· Website contains advertisement in Russian;
· Other circumstances demonstrating intention of website’s owner to cover Russian market in its business operations (its business strategy).
Meaning of “collection of personal data”
Collection of personal data implies intentional process aimed at receipt of information directly from a personal data subject (or receipt of information via third parties engaged for this particular purpose). Situations where data appears to be available to data operator incidentally shall not be qualified as collection of personal data (e.g. receipt of email with personal data, circulation of contact information (of employees / representatives) between entities in the course of their lawful business activities, etc.).
Cross-border data transfer
Personal data in course of their collection shall be initially placed in so-called primary database, which shall be located and maintained (by way of performing target types of processing[1]<file:///C:/NRPortbl/ALRUD_DMS/EUTKINA/6394495_3.docx#_ftn1> ), in Russia. Personal data contained in primary database may be transferred abroad and be placed in other databases (secondary databases) if the rules on cross-border data transfer are complied with.
Secondary databases located abroad may be used, in particular, for purposes of data backup, rendering services on advertising distribution, etc.
The Ministry also confirmed that provision of remote access to the database located in Russia for other parties abroad shall not be qualified as violation of the Personal Data Localization Law.
Operation of the Personal Data Localization Law in time
Ministry confirmed that the Personal Data Localization Law does not have retroactive effect. Thus, it does not apply to processing of personal data which was carried out before 1 September 2015. However, if target types of processing with the data are carried out as of 1 September 2015 the Personal Data Localization Law covers such processing.
Application of the Personal Data Localization Law to personal data collected and transferred abroad before 1 September 2015
Personal Data Localization Law does not apply to such data as longs as such data remains unchanged and is not subject to target types of processing. If target types of processing are carried out with such data as of 1 September 2015, data operators shall comply with their obligations under the Personal Data Localization Law.
Determining citizenship of personal data subjects
Legislation does not specify particular mechanisms for this. Thus, data operators may apply any relevant methods at their own discretion. The Ministry suggests applying of the following principle (unless data operator elaborates its own methods / mechanisms): the Personal Data Localization Law applies to all personal data collected in Russia.
Use of foreign databases duplicating Russian database
Russian legislation does not contain restrictions on using database locating abroad for processing of personal data. However, carrying out target types of processing with the use of database located abroad is possible if the volume of personal data contained in Russian database is more significant or equal to the one of database located abroad.
Consent of personal data subject as an exemption from the Personal Data Localization Law
The Ministry clarified that the consent of personal data subject for processing of his/her personal data in databases abroad does not release a data operator from the obligation to comply with the Personal Data Localization Law.
Meaning of “personal data”
The Ministry specified the definition containing in the Russian Federal Law On Personal Data No. 152-FZ: personal data is any information related to directly or indirectly identified or identifiable individual. The Ministry also specified that determining of more accurate content of personal data or list of such data is unrealizable.
Operations with personal data out of the scope of the Personal Data Localization Law
The Ministry confirmed that such actions with personal data as use, transfer, depersonalization, blocking, deletion, destruction can be performed with use of databases abroad.
The Ministry specified that the term “use of personal data” may mean operations with personal data, which do not relate to other operations with personal data (such as collection, recording, systematization, accumulation, storage, adaptation or alteration, retrieval, extraction, transfer, depersonalization, blocking, deletion, destruction), including adoption of decisions for adoption of which personal data was collected.
* * *
We hope you will find this information helpful. Should you have any questions, please do not hesitate to contact Irina Anyukhina (ianyukhina@alrud.com), Partner.
Yours faithfully,
ALRUD Law Firm
Please note: All information was obtained from publicly available sources. The authors of this information letter assume no liability for the consequences of reliance upon, or decision-making based on such information.
[ORIGINALLY PUBLISHED AS ALRUD’S NEWSLETTER – REPRODUCED WITH PERMISSION BY ALRUD Law Firm, 17 Skakovaya street, Building 2, 6th Floor, 125040 Moscow, Russia, http://www.alrud.com]